From 73ad642ba462d0992e1903012eee4ebfec89ed69 Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Wed, 18 May 2016 10:56:36 +0200 Subject: src: add support for IPv6 NAT The conntrackd daemon lacks support for syncing IPv6 NATed connections. This patch adds support for managing the IPv6 part of struct __nfct_nat, also updating the corresponsing symbols. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- src/conntrack/build_mnl.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'src/conntrack/build_mnl.c') diff --git a/src/conntrack/build_mnl.c b/src/conntrack/build_mnl.c index f4bb287..2118bf3 100644 --- a/src/conntrack/build_mnl.c +++ b/src/conntrack/build_mnl.c @@ -271,6 +271,10 @@ nfct_build_nat(struct nlmsghdr *nlh, const struct __nfct_nat *nat, case AF_INET: mnl_attr_put_u32(nlh, CTA_NAT_MINIP, nat->min_ip.v4); break; + case AF_INET6: + mnl_attr_put(nlh, CTA_NAT_V6_MINIP, sizeof(struct in6_addr), + &nat->min_ip.v6); + break; default: break; } @@ -301,6 +305,17 @@ nfct_build_snat_ipv4(struct nlmsghdr *nlh, const struct nf_conntrack *ct) return 0; } +static int +nfct_build_snat_ipv6(struct nlmsghdr *nlh, const struct nf_conntrack *ct) +{ + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, CTA_NAT_SRC); + nfct_build_nat(nlh, &ct->snat, AF_INET6); + mnl_attr_nest_end(nlh, nest); + return 0; +} + static int nfct_build_snat_port(struct nlmsghdr *nlh, const struct nf_conntrack *ct) { @@ -336,6 +351,17 @@ nfct_build_dnat_ipv4(struct nlmsghdr *nlh, const struct nf_conntrack *ct) return 0; } +static int +nfct_build_dnat_ipv6(struct nlmsghdr *nlh, const struct nf_conntrack *ct) +{ + struct nlattr *nest; + + nest = mnl_attr_nest_start(nlh, CTA_NAT_DST); + nfct_build_nat(nlh, &ct->dnat, AF_INET6); + mnl_attr_nest_end(nlh, nest); + return 0; +} + static int nfct_build_dnat_port(struct nlmsghdr *nlh, const struct nf_conntrack *ct) { @@ -508,8 +534,13 @@ nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct) if (test_bit(ATTR_SNAT_IPV4, ct->head.set) && test_bit(ATTR_SNAT_PORT, ct->head.set)) { nfct_build_snat(nlh, ct, AF_INET); + } else if (test_bit(ATTR_SNAT_IPV6, ct->head.set) && + test_bit(ATTR_SNAT_PORT, ct->head.set)) { + nfct_build_snat(nlh, ct, AF_INET6); } else if (test_bit(ATTR_SNAT_IPV4, ct->head.set)) { nfct_build_snat_ipv4(nlh, ct); + } else if (test_bit(ATTR_SNAT_IPV6, ct->head.set)) { + nfct_build_snat_ipv6(nlh, ct); } else if (test_bit(ATTR_SNAT_PORT, ct->head.set)) { nfct_build_snat_port(nlh, ct); } @@ -517,8 +548,13 @@ nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct) if (test_bit(ATTR_DNAT_IPV4, ct->head.set) && test_bit(ATTR_DNAT_PORT, ct->head.set)) { nfct_build_dnat(nlh, ct, AF_INET); + } else if (test_bit(ATTR_DNAT_IPV6, ct->head.set) && + test_bit(ATTR_DNAT_PORT, ct->head.set)) { + nfct_build_dnat(nlh, ct, AF_INET6); } else if (test_bit(ATTR_DNAT_IPV4, ct->head.set)) { nfct_build_dnat_ipv4(nlh, ct); + } else if (test_bit(ATTR_DNAT_IPV6, ct->head.set)) { + nfct_build_dnat_ipv6(nlh, ct); } else if (test_bit(ATTR_DNAT_PORT, ct->head.set)) { nfct_build_dnat_port(nlh, ct); } -- cgit v1.2.3